MEDIUM 5.8 GitHub
CVE-2026-73609
SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering
### Summary
`/api/attr/getBookmarkLabels` is registered with `CheckAuth` only and applies no filtering of any kind. It runs a scan of the entire `blocks` table and returns the distinct set of every bookmark label in the workspace. An anonymous reader in publish mode receives the author's complete bookmark vocabulary, regardless of whether the bookmarked blocks live in published, hidden, password-protected or forbidden documents.
The adjacent endpoint that returns bookmarks with their blocks do
Affected Products
- go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260812083335-251596fc0de2
References
- https://github.com/advisories/GHSA-j4ph-9xwf-wcj4
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4ph-9xwf-wcj4
- https://nvd.nist.gov/vuln/detail/CVE-2026-73609
- https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0
This medium severity vulnerability with a CVSS score of 5.8 was published on 2026-10-01 via GitHub. Affected: go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260812083335-251596fc0de2.
vulnfeed aggregates 9446 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.